GSEC Web Communication Security — All Questions With Answers

Question 1

An analyst is investigating a web application that frequently transmits sensitive session tokens over plain HTTP during initial login redirection before switching to HTTPS. Which vulnerability class does this pattern represent, and how should it be remediated?

Accepted Answer

Broken Authentication; remediated by deploying HTTP Strict Transport Security headers to enforce encrypted communications permanently.. Insecure transport layer protections allow attackers to intercept cleartext session identifiers via network sniffing. Enforcing mandatory HTTP Strict Transport Security guarantees that modern browsers reject unencrypted connections completely. This mitigation blocks downgrade attacks and protects confidentiality during the entire web browsing session lifecycle.

Answer

Cross-Site Request Forgery; remediated by implementing unpredictable anti-CSRF tokens in all state-changing form submissions.

Answer

Sensitive Data Exposure; remediated by disabling cookies entirely and relying solely on URL parameter-based session management.

Answer

Insecure Deserialization; remediated by validating object types during the deserialization phase of incoming HTTP requests.

Question 2

A security engineer notices that a web application reflects user-supplied input directly inside a JavaScript execution context within a script block without proper encoding. Which remediation strategy provides the most effective defense-in-depth against resulting XSS attacks?

Accepted Answer

Apply strict context-aware output encoding for JavaScript variables combined with a robust Content Security Policy header.. Context-aware output encoding neutralizes malicious payloads by converting special characters into safe HTML or JavaScript escape sequences before rendering. Combining this practice with a strict Content Security Policy establishes multiple defensive layers that prevent unauthorized script execution even if encoding fails.

Answer

Deploy a restrictive Content Security Policy header that disables inline script execution and restricts trusted script sources.

Answer

Implement robust server-side input validation using regular expressions to strip out all angle brackets and quotation marks.

Answer

Store all user-supplied input inside encrypted database tables to ensure confidentiality before rendering it in the browser.

Question 3

A security architect is designing a secure API authentication workflow using JSON Web Tokens. Which THREE implementation practices are critical to ensure token integrity and prevent signature verification bypasses?

Accepted Answer

Explicitly enforce an approved list of cryptographic algorithms during token verification to reject the 'none' algorithm.. Securing JSON Web Tokens requires explicitly defining allowed cryptographic algorithms in the verification function to prevent algorithm substitution attacks. Additionally, validating the token expiration claim prevents replay attacks, while utilizing strong symmetric or asymmetric keys ensures signatures cannot be forged.

Answer

Store the secret signing key directly within client-side local storage to simplify authentication retrieval logic.

Answer

Encode all user session payloads in plain Base64 format inside the token body for maximum read performance.

Question 4

Which TWO of the following headers are critical for preventing Clickjacking and Cross-Site Scripting (XSS) in modern web applications? (Choose two)

Accepted Answer

Content-Security-Policy. Security headers are essential for browser-based defense-in-depth. Content-Security-Policy (CSP) provides a powerful mechanism to restrict resource loading, effectively mitigating XSS. X-Frame-Options is the traditional standard to prevent clickjacking by restricting how a page can be embedded in frames. Together, these headers significantly harden the browser's interaction with the web application by limiting the browser's willingness to execute malicious content or participate in frame-based UI redressing attacks.

Answer

Strict-Transport-Security

Answer

X-Content-Type-Options

Answer

Access-Control-Allow-Origin

Question 5

A security engineer is reviewing a web application's login flow. The application uses a session cookie that is set with the Secure attribute, but the engineer notices that the cookie is still being sent over an unencrypted HTTP connection during the initial login request. Which of the following is the most likely explanation for this behavior?

Accepted Answer

The Secure attribute only prevents the cookie from being sent over HTTP after it has been set, but the initial transmission of credentials can still occur over HTTP.. The Secure attribute ensures that a cookie is only sent over HTTPS, but it does not protect the initial request that sets the cookie if that request is made over HTTP. In this scenario, the login form is submitted over HTTP, so credentials and any session cookie in the response are exposed. The correct answer identifies that the attribute applies only after the cookie is set, and the initial transmission remains vulnerable.

Answer

The server is misconfigured and is not enforcing HTTPS for the login page, but the Secure attribute will still protect the cookie after authentication.

Answer

The Secure attribute is not supported by the browser being used, so the cookie is sent over both HTTP and HTTPS.

Answer

The Secure attribute only applies to cookies with the HttpOnly flag, so without HttpOnly, the cookie is sent over HTTP.

Question 6

A security engineer is configuring a web server to mitigate Cross-Site Request Forgery (CSRF) attacks. The application uses session cookies for authentication. Which of the following implementations provides the strongest protection against CSRF while maintaining usability?

Accepted Answer

Implement a synchronized token pattern with per-request tokens.. The synchronized token pattern is a robust CSRF defense because it requires a secret, unpredictable token that is tied to the user's session and validated on the server. Unlike SameSite cookies, it does not interfere with cross-site navigation. Re-authentication is too disruptive, and Origin header validation alone is insufficient due to potential spoofing or absence. Thus, the token pattern balances security and usability effectively.

Answer

Require re-authentication for every state-changing request.

Answer

Set the 'SameSite' attribute of session cookies to 'Strict'.

Answer

Validate the 'Origin' header on all incoming requests.

Question 7

A security engineer is configuring TLS for a web application. The organization requires that all connections use forward secrecy to protect past session keys if the server's private key is compromised. Which of the following cipher suites should be selected to meet this requirement?

Accepted Answer

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Forward secrecy is achieved through ephemeral key exchanges like ECDHE or DHE. The cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 uses ECDHE, providing forward secrecy along with modern AEAD encryption (GCM). The RSA-based suites do not offer forward secrecy. While DHE also provides forward secrecy, ECDHE is more efficient and commonly preferred. Therefore, the ECDHE suite is the correct choice.

Answer

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

Answer

TLS_RSA_WITH_AES_128_GCM_SHA256

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Question 8

A GSEC analyst is reviewing a web application that sets session cookies with the Secure and HttpOnly attributes. The analyst observes that an attacker on the same local network can still capture the session cookie when a user visits the site over an unencrypted HTTP URL that redirects to HTTPS. Which mechanism should the organization implement to prevent the cookie from ever being transmitted over cleartext HTTP?

Accepted Answer

Configure the web server to send the Strict-Transport-Security header with a max-age directive.. Strict-Transport-Security (HSTS) is the only mechanism that makes the browser upgrade all requests for the host to HTTPS before any cleartext transmission occurs. Secure and HttpOnly protect the cookie in transit and from script access, but they do not stop the initial HTTP request that exposes the cookie. HSTS closes that gap.

Answer

Set the cookie's Path attribute to / and the Domain attribute to the exact hostname.

Answer

Enable HTTP Public Key Pinning (HPKP) on the web server.

Answer

Add the SameSite=Strict attribute to the session cookie.

Question 9

An administrator observes that internal users are receiving certificate warnings when accessing a new internal web application. The organization uses an internal Certificate Authority (CA). What is the primary cause of this behavior?

Accepted Answer

The internal Root CA certificate is not installed in the client's local trust store.. Certificate warnings occur when a client cannot establish a chain of trust back to a trusted Root CA. In internal environments, the internal CA certificate must be explicitly imported into the client's trusted root store. Without this root trust, the browser cannot verify the digital signature of the server's certificate, resulting in a trust error. This is a fundamental concept in PKI management for enterprise web security.

Answer

The server certificate has expired, triggering a validity date error in the browser.

Answer

The web server failed to send the intermediate certificate in the handshake process.

Answer

The web application is utilizing an outdated TLS version that browsers no longer support.

Question 10

A developer wants to prevent sensitive cookies from being transmitted over unencrypted HTTP connections. Which cookie attribute is specifically designed to enforce this requirement?

Accepted Answer

Secure. The Secure attribute is a critical security control for web applications. When a cookie is marked as Secure, the browser will only transmit that cookie if the request is being made over an encrypted connection, such as HTTPS. This prevents session tokens or sensitive data from being intercepted in cleartext via man-in-the-middle attacks, ensuring that transport-layer security is effectively utilized for all sensitive session-based interactions.

Answer

HttpOnly

Answer

SameSite=Strict

Answer

Path=/secure

Question 11

Refer to the exhibit. Which security risk does the 'HttpOnly' flag specifically mitigate?

Accepted Answer

Cross-Site Scripting (XSS) session theft. The HttpOnly flag is a vital defense against session hijacking via XSS. When this flag is enabled, the browser prevents client-side scripts, such as JavaScript, from accessing the cookie via the document.cookie object. If an attacker successfully executes an XSS attack, they cannot steal the session cookie, thereby preventing them from impersonating the user's session. This is a core defense-in-depth practice for protecting authentication tokens in modern web applications.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) interception

Answer

SQL Injection (SQLi)

Question 12

During a web application audit, you determine that the server is vulnerable to a 'Slowloris' attack. What is the most likely symptom of this attack on the web server?

Accepted Answer

Exhaustion of available connection slots. Slowloris is a low-bandwidth Denial-of-Service (DoS) attack that keeps connections open by sending partial HTTP requests. By never completing the request headers, the server's connection pool becomes exhausted, leaving no threads available to handle legitimate users. This is a classic example of an application-layer DoS attack, which highlights the importance of configuring proper timeout settings and resource limits on web servers like Apache or Nginx.

Answer

Complete server crash due to memory corruption

Answer

Database downtime caused by excessive query volume

Answer

Unauthorized access to the application root directory

Question 13

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

Accepted Answer

It lacks forward secrecy because the RSA key exchange does not generate ephemeral session keys.. The cipher suite TLS_RSA_WITH_AES_128_CBC_SHA relies on static RSA key exchange, where the client encrypts a premaster secret with the server's public key. This means the session key is tied to the server's long-term private key. If that private key is compromised later, an attacker who recorded the encrypted session can decrypt it retroactively. Forward secrecy requires ephemeral key exchanges like ECDHE or DHE, which generate unique session keys that are not recoverable from the long-term key.

Answer

It uses AES in CBC mode, which is vulnerable to padding oracle attacks such as POODLE.

Answer

It uses SHA-1 for integrity, which is considered cryptographically broken for MACs.

Answer

It allows downgrade to export-grade cryptography because of the RSA key exchange.

Question 14

A security analyst is examining a web application that uses HTTP Strict Transport Security (HSTS). The analyst notices that the HSTS header is only sent on HTTPS responses and includes the 'preload' directive. Which additional measure must be taken to ensure the domain is included in browser preload lists?

Accepted Answer

Submit the domain to the HSTS preload list maintained by Google, and ensure the header includes 'includeSubDomains' and a max-age of at least one year.. To preload HSTS, the domain must meet strict criteria: the HSTS header must include 'includeSubDomains', 'preload', and a max-age of at least one year. The 'preload' directive alone does not trigger automatic inclusion; the domain must be submitted to the preload list service. Once accepted, browsers hardcode the domain, enforcing HTTPS even on the first visit. This prevents SSL stripping attacks during initial connections.

Answer

Ensure the HSTS header is sent with a max-age of at least six months and includes the 'preload' directive, then submit the domain to the preload list.

Answer

Configure the server to redirect all HTTP requests to HTTPS with a 301 status code and include the HSTS header in the redirect response.

Answer

Add the 'preload' directive to the HSTS header and wait for browsers to automatically discover and add the domain to their preload lists.

Question 15

A security analyst is reviewing a web application that allows users to upload profile pictures. The application accepts files with .jpg and .png extensions, but the analyst discovers that an attacker can upload a file named 'avatar.php.jpg' and then access it directly via a URL. The server executes the file as PHP. Which security control would most directly prevent this type of attack?

Accepted Answer

Store uploaded files outside the web root and serve them via a handler that validates file content.. The vulnerability arises because the server executes uploaded files based on their extension or content. Storing files outside the web root and serving them through a validating handler prevents direct execution and ensures only safe content is delivered. This approach directly addresses the root cause, whereas other controls like CSP, HTTPS, or cookie flags do not stop server-side code execution.

Answer

Implement a strict Content Security Policy (CSP) that disallows inline scripts.

Answer

Enforce HTTPS for all upload and download requests to prevent man-in-the-middle attacks.

Answer

Set the 'secure' attribute on session cookies to ensure they are only sent over encrypted connections.

Question 16

A web developer is implementing a new session management system and wants to ensure that session cookies are not accessible via JavaScript to mitigate cross-site scripting (XSS) attacks. Which cookie attribute should be set?

Accepted Answer

HttpOnly. The HttpOnly attribute is specifically designed to prevent client-side scripts from accessing cookies. By setting HttpOnly, the cookie is protected from theft via XSS attacks that execute JavaScript in the victim's browser. The other attributes serve different purposes: Secure ensures HTTPS transmission, SameSite mitigates CSRF, and Domain controls cookie scope. Only HttpOnly directly addresses the requirement.

Answer

SameSite

Answer

Domain

Answer

Secure

Question 17

A security analyst is reviewing a web application's HTTP response headers and notices the following header: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'. The analyst is concerned about the application's resilience to cross-site scripting (XSS). Which of the following best describes the security implication of this policy?

Accepted Answer

The policy is insecure because it allows inline scripts, which can be exploited by XSS attacks.. The Content-Security-Policy header includes 'unsafe-inline' in the script-src directive, which permits inline JavaScript execution. This directly undermines CSP's ability to prevent XSS attacks, as injected inline scripts will run. The correct answer identifies that allowing inline scripts makes the policy insecure. The other options incorrectly focus on external script restrictions or reporting, missing the critical weakness.

Answer

The policy is insecure because it lacks a report-uri directive, so violations cannot be monitored.

Answer

The policy is secure because default-src 'self' prevents loading scripts from external domains, mitigating XSS.

Answer

The policy is secure because it restricts scripts to the same origin and disallows inline scripts.

Question 18

A security engineer is configuring a web server to enforce secure communication and prevent man-in-the-middle attacks. The engineer wants to implement HTTP Strict Transport Security (HSTS) and ensure that it is properly deployed. Which TWO of the following are required for HSTS to be effective? (Choose two.)

Accepted Answer

The HSTS header must be served over a valid HTTPS connection with a trusted certificate.. HSTS is enabled when the server sends the Strict-Transport-Security header over a trusted HTTPS connection. The browser then enforces HTTPS for future requests. A valid certificate is necessary for the browser to accept the header. Redirects and includeSubDomains are optional enhancements, and specific TLS versions are not mandated by HSTS itself. Therefore, the required elements are the header over HTTPS and a trusted certificate.

Answer

The HSTS header must include the includeSubDomains directive to protect all subdomains.

Answer

The server must be configured to support TLS 1.2 or higher for HSTS to function.

Answer

The server must redirect all HTTP requests to HTTPS before the HSTS header is processed.

Question 19

A security analyst is examining a web application that uses JSON Web Tokens (JWT) for authentication. The analyst captures a token and notices that the header contains "alg": "none". The analyst is concerned about the security of the application. Which of the following best describes the risk associated with this token?

Accepted Answer

The token is unsigned, allowing an attacker to modify the payload and forge valid tokens.. A JWT with "alg": "none" is unsigned, meaning it has no integrity protection. An attacker can tamper with the payload and, if the server accepts such tokens, forge arbitrary claims. This can lead to authentication bypass or privilege escalation. The correct answer identifies that the token is unsigned and can be modified. The other options mischaracterize the token as encrypted, weakly signed, or solely vulnerable to replay, missing the core issue of missing signature verification.

Answer

The token uses a weak signing algorithm that can be brute-forced to recover the secret key.

Answer

The token is vulnerable to replay attacks because it lacks an expiration claim.

Answer

The token is encrypted, so the contents cannot be read by an attacker.

Question 20

A security administrator is reviewing web server logs and notices a high volume of requests with different User-Agent strings, all targeting the same URL with varying query parameters. The requests appear to be attempting to inject SQL commands. Which of the following is the most effective mitigation to prevent SQL injection in this scenario?

Accepted Answer

Use parameterized queries (prepared statements) for all database access.. SQL injection occurs when user input is improperly concatenated into SQL queries. Parameterized queries, also known as prepared statements, ensure that input is bound as parameters and never interpreted as SQL code. This eliminates the vulnerability entirely. While WAFs and input validation can help, they are not as reliable or comprehensive. Therefore, using parameterized queries is the most effective mitigation.

Answer

Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Answer

Implement strict input validation to allow only alphanumeric characters.

Answer

Encode all user input using HTML entity encoding before storing in the database.

GSEC Web Communication Security — All Questions With Answers

An analyst is investigating a web application that frequently transmits sensitive session tokens over plain HTTP during initial login redirection before switching to HTTPS. Which vulnerability class does this pattern represent, and how should it be remediated?

A security engineer notices that a web application reflects user-supplied input directly inside a JavaScript execution context within a script block without proper encoding. Which remediation strategy provides the most effective defense-in-depth against resulting XSS attacks?

A security architect is designing a secure API authentication workflow using JSON Web Tokens. Which THREE implementation practices are critical to ensure token integrity and prevent signature verification bypasses?

Which TWO of the following headers are critical for preventing Clickjacking and Cross-Site Scripting (XSS) in modern web applications? (Choose two)

A security engineer is configuring a web server to mitigate Cross-Site Request Forgery (CSRF) attacks. The application uses session cookies for authentication. Which of the following implementations provides the strongest protection against CSRF while maintaining usability?

A security engineer is configuring TLS for a web application. The organization requires that all connections use forward secrecy to protect past session keys if the server's private key is compromised. Which of the following cipher suites should be selected to meet this requirement?

An administrator observes that internal users are receiving certificate warnings when accessing a new internal web application. The organization uses an internal Certificate Authority (CA). What is the primary cause of this behavior?

A developer wants to prevent sensitive cookies from being transmitted over unencrypted HTTP connections. Which cookie attribute is specifically designed to enforce this requirement?

Refer to the exhibit. Which security risk does the 'HttpOnly' flag specifically mitigate?

Exhibit

During a web application audit, you determine that the server is vulnerable to a 'Slowloris' attack. What is the most likely symptom of this attack on the web server?

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

A web developer is implementing a new session management system and wants to ensure that session cookies are not accessible via JavaScript to mitigate cross-site scripting (XSS) attacks. Which cookie attribute should be set?

GSEC Web Communication Security — All Questions With Answers

An analyst is investigating a web application that frequently transmits sensitive session tokens over plain HTTP during initial login redirection before switching to HTTPS. Which vulnerability class does this pattern represent, and how should it be remediated?

A security engineer notices that a web application reflects user-supplied input directly inside a JavaScript execution context within a script block without proper encoding. Which remediation strategy provides the most effective defense-in-depth against resulting XSS attacks?

A security architect is designing a secure API authentication workflow using JSON Web Tokens. Which THREE implementation practices are critical to ensure token integrity and prevent signature verification bypasses?

Which TWO of the following headers are critical for preventing Clickjacking and Cross-Site Scripting (XSS) in modern web applications? (Choose two)

A security engineer is configuring a web server to mitigate Cross-Site Request Forgery (CSRF) attacks. The application uses session cookies for authentication. Which of the following implementations provides the strongest protection against CSRF while maintaining usability?

A security engineer is configuring TLS for a web application. The organization requires that all connections use forward secrecy to protect past session keys if the server's private key is compromised. Which of the following cipher suites should be selected to meet this requirement?

An administrator observes that internal users are receiving certificate warnings when accessing a new internal web application. The organization uses an internal Certificate Authority (CA). What is the primary cause of this behavior?

A developer wants to prevent sensitive cookies from being transmitted over unencrypted HTTP connections. Which cookie attribute is specifically designed to enforce this requirement?

Refer to the exhibit. Which security risk does the 'HttpOnly' flag specifically mitigate?

Exhibit

During a web application audit, you determine that the server is vulnerable to a 'Slowloris' attack. What is the most likely symptom of this attack on the web server?

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

A web developer is implementing a new session management system and wants to ensure that session cookies are not accessible via JavaScript to mitigate cross-site scripting (XSS) attacks. Which cookie attribute should be set?